CVE-2026-109983

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The autocomplete REST endpoint is registered with a permission callback that unconditionally returns true, meaning any site visitor — including unauthenticated users — can trigger the payload simply by typing in the YMC filter search box, while only Author-level access is required to store it.

• CWE-79

• https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/assets/js/frontend/ymc-public.min.js#L10
• https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/abstracts/FG_REST_Abstract_Controller.php#L66
• https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php#L135
• https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.19/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php#L148
• https://plugins.trac.wordpress.org/browser/ymc-smart-filter/tags/3.12.20/ymc2/src/api/controllers/frontend/FG_REST_Frontend_Search_Controller.php
• https://wordpress.org/plugins/ymc-smart-filter
• https://www.wordfence.com/threat-intel/vulnerabilities/id/27cfa62d-ba16-4344-be0c-82cac4d21d1c?source=cve

Published

Oct 17, 2026

Last Modified

Oct 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10997Insufficient policy enforcement in Extensions in Google Chro…6.5
• CVE-2026-109970A flaw was found in the clevis PKCS#11 pin. The clevis-luks-…4.7
• CVE-2026-109971A flaw was found in the clevis PKCS#11 pin. The clevis-decry…4.7
• CVE-2026-109976A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs1…4.7
• CVE-2026-10998Out of bounds read in Media in Google Chrome prior to 149.0.…4
• CVE-2026-109982The MB Custom Post Types & Custom Taxonomies WordPress plugi…4.2
• CVE-2026-109985The xSpeed Cache: AI-Powered Performance Hub with MCP, Cachi…6.4
• CVE-2026-109989The Themify Popup plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-10999Integer overflow in ANGLE in Google Chrome on Windows prior …6.5
• CVE-2026-109990The Flying Scripts: Delay JavaScript to Improve Site Speed &…7.2
• CVE-2026-109998The Mang Board plugin for WordPress is vulnerable to Stored …7.2
• CVE-2026-11000Use after free in Fonts in Google Chrome on Linux prior to 1…8.8